Getting Data In

Help on strftime

jip31
Motivator

Hi

I have a field time called LastLogonDate with this format

6/28/2023 1:47.35 PM

I want to format this field in a new field 

So i am doing

| eval Last=strftime(LastLogonDate, "%d-%m-%y") but it doenst works 

What is wrong please?

 

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

I don't know why it doesn't run, so, please try this workaround:

| rex field=LastLogonDate "^(?<month>\d+)\/(?<day>\d+)\/(?<year>\d+)"
| eval day=if(day<10,"0".day,day), month=if(month<10,"0".month,month)
| eval Last=day."/".month."/".year

that I tested.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31 ,

you have to operate two conversions:

| eval Last=strftime(strptime(LastLogonDate, "%m/%d/%Y %I:%H.%S %p"),"%d-%m-%y") 

Only one beware: you used ":" betweeen hours and minutes and "." between minutes and seconds: is it an error or correct?

I followed your indication.

Ciao.

Giuseppe

0 Karma

jip31
Motivator

It's an error

I had : in your example between H and S

Your example wirks but only for some LadtLogonDate value but not for all

What is wrong please?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

if you can confirm that the format is "6/28/2023 1:47:35 PM", it should be correct.

As I said, check the format of the separators between hours, minutes and seconds: if one is wrong, all the formula is wrong.

| eval Last=strftime(strptime(LastLogonDate, "%m/%d/%Y %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

0 Karma

jip31
Motivator

It's strange because 7/3/2023 8:59:14 AM returns nothing while 1/18/2916 9:15:23 AM returns well 18-01-16 even if the forkat is the same...

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

the issue is in the day format, please try this:

| eval Last=strftime(strptime(LastLogonDate, "%m/%e/%Y %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

 

0 Karma

jip31
Motivator

sorry but exactly the same issue

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

please try this:

| eval Last=strftime(strptime(LastLogonDate, "%x %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

0 Karma

jip31
Motivator

hi

it changes nothing

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

I don't know why it doesn't run, so, please try this workaround:

| rex field=LastLogonDate "^(?<month>\d+)\/(?<day>\d+)\/(?<year>\d+)"
| eval day=if(day<10,"0".day,day), month=if(month<10,"0".month,month)
| eval Last=day."/".month."/".year

that I tested.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...